ScarfaceStealer: Electron-Delivered Infostealer with Sandbox-Scoring Evasion and Smart-Contract C2
ScarfaceStealer (TL-2026-2455), also tracked as ScarfaceStealer.Rocket, is a high-severity malware campaign, first published 2026-09-12. It has no confirmed attribution, affects N/A (trojanized third-party Electron applications, not a vendor, maps to 18 MITRE ATT&CK techniques (T1027, T1027.002, T1036), and is covered by 9 detection rules and 15 indicators of compromise.
Key facts for TL-2026-2455
- Threat ID
- TL-2026-2455
- Also known as
- ScarfaceStealer.Rocket, Scarface Stealer
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-09-12
- Last reviewed
- 2026-09-12
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in ScarfaceStealer
Malware and tooling: ScarfaceStealer, ScarfaceStealer.Rocket, 0x25C73C98F0E509Bd909cd1C1456EB973Dda60344
ScarfaceStealer is an actively distributed Windows infostealer family (tracked since December 2025) whose latest build, analyzed by Joe Security on 2026-07-14, is delivered via an NSIS-packaged Electron application masquerading as an AI tool named ClaudeMythos.exe. The dropper performs hardware-based sandbox checks before a final payload scores eleven environmental indicators and, if it passes, retrieves its C2 address from an Ethereum/Polygon smart contract using an EtherHiding-style dead-drop resolver.
How ScarfaceStealer works
ScarfaceStealer is a Windows information-stealer family first observed in the wild on 2025-12-03 (MalwareBazaar), with 196 tracked samples submitted through at least 2026-08-10. An earlier, Go-compiled build documented by SonicWall on 2026-03-15 (internally flagged as ScarfaceStealer.Rocket) targets browser cookies, saved passwords, browsing history and autofill data, alongside hardware fingerprinting, network configuration, installed-software enumeration, and functions consistent with microphone and screenshot capture. That build is heavily obfuscated with space/rocket-themed junk strings and randomly concatenated English-word function names (e.g. LAUNCH_COMMAND, TELEMETRY, IGNITION, MISSION_ABORT), leaving only 47 human-readable strings visible under static analysis, and exfiltrates over HTTP/TLS.
The variant analyzed by Joe Security on 2026-07-14 represents a distribution and anti-analysis evolution of the same family. It is delivered as an NSIS-packaged Electron application disguised as an AI-themed utility named ClaudeMythos.exe (sibling lures observed for the family include Kitchen Canvas, Food or Meal Formula, and DocConvertWizard). Infection proceeds in two evasion stages: (1) the Electron/JavaScript loader enforces minimum hardware thresholds (>=4GB RAM, >=2 CPU cores) and validates the GPU vendor via a PowerShell query against the Win32_VideoController WMI class, silently exiting via app.quit()/process.exit(0) if unmet; (2) the unpacked final payload runs a weighted 11-indicator sandbox-suspicion scorer covering analysis-tool/debugger process names, CPU core count, physical RAM, GPU vendor allow-list, username blocklist, system uptime plausibility, sleep-timing accuracy, remote-session detection (GetSystemMetrics/SM_REMOTESESSION), CPU instruction (__cpuid) timing, CPUID leaf vendor/brand consistency, and GPU PCI vendor-ID blocklisting against common hypervisor IDs (QEMU/BOCHS 0x1234, VMware 0x15AD, VirtualBox 0x80EE, QEMU VirtIO 0x1B36, Red Hat VirtIO 0x1AF4, Google Compute Engine 0x1AE0). A score of 7 or higher routes execution into a decoy loop of continuous message boxes instead of the payload. Internal strings are protected with a modified FNV-1a hash (UTF-16LE, custom seed 0xeb1af681 rather than the standard 0x811c9dc5).
Once evasion checks pass, the payload retrieves its C2 configuration from the Polygon blockchain by issuing an eth_call (function selector 0xd040556c) against the smart contract at 0x25C73C98F0E509Bd909cd1C1456EB973Dda60344 via the public RPC endpoint polygon.drpc.org. The ABI-encoded response is decoded and then decrypted with AES-256-CBC to yield the live C2 endpoint check.mentor-square80.click:443, which is subsequently queried at the path /api/v3/health using a static Chrome 146 User-Agent string. This dead-drop-resolver pattern -- storing and rotating C2 addresses inside a public, takedown-resistant smart contract rather than DNS/IP infrastructure -- places the sample in the broader 'EtherHiding' technique family also used by malware such as EtherRAT and Tsundere (per eSentire's 2026-03-25 analysis), which similarly abuse Ethereum/BNB smart contracts and public RPC providers to survive infrastructure takedowns and re-task already-compromised hosts.
The ClaudeMythos.exe lure specifically targets users seeking AI tools, aligning with the broader trend of trojanized 'AI utility' Electron apps used as an infostealer delivery vector.
MITRE ATT&CK techniques used in TL-2026-2455
Defense Evasion
T1027 Obfuscated Files or Information; T1027.002 Software Packing; T1036 Masquerading; T1497.001 System Checks; T1497.003 Time Based Checks; T1620 Reflective Code Loading; T1622 Debugger Evasion
Discovery
T1057 Process Discovery; T1082 System Information Discovery
Execution
T1059.001 PowerShell; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1573.001 Symmetric Cryptography
Collection
T1113 Screen Capture; T1123 Audio Capture
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
Affected products and versions in ScarfaceStealer
- N/A (trojanized third-party Electron applications, not a vendor product vulnerability) — Windows hosts on which a ScarfaceStealer-trojanized Electron/NSIS installer (e.g. ClaudeMythos.exe, Kitchen Canvas, Food or Meal Formula, DocConvertWizard) is executed
Vulnerable versions: Any Windows version capable of running Electron/NSIS-packaged applications
Remediation for ScarfaceStealer
Immediate actions
- Block/alert on DNS and TLS connections to check.mentor-square80.click and the /api/v3/health beacon path at the perimeter and on endpoints
- Alert on outbound eth_call/JSON-RPC traffic to polygon.drpc.org (or other public Polygon/Ethereum RPC endpoints) from standard user workstations, and specifically on queries referencing contract 0x25C73C98F0E509Bd909cd1C1456EB973Dda60344 with selector 0xd040556c
- Hunt for and quarantine executables named ClaudeMythos.exe, Kitchen Canvas, Food or Meal Formula, or DocConvertWizard, and for file hashes matching the SHA-256 IOCs below
- Isolate and forensically image any host that ran a matching sample; force-rotate browser-stored passwords, cookies/session tokens, and any credentials autofilled on that host
Workarounds
- Restrict standard users from installing/running unsigned Electron applications, especially ones sourced outside official app stores or vendor sites
- Where feasible, constrain PowerShell execution policy for standard users to reduce the loader's ability to run its Win32_VideoController fingerprinting query
Longer-term hardening
- Add behavioral detections for pre-execution hypervisor/GPU fingerprinting (PCI vendor IDs 0x1234, 0x15AD, 0x80EE, 0x1B36, 0x1AF4, 0x1AE0) and for PowerShell queries against Win32_VideoController immediately following execution of a newly downloaded Electron/NSIS installer
- Extend network detection content to treat public blockchain RPC endpoints (drpc.org, infura.io, alchemy.com, etc.) as a monitored C2-resolver channel, not just conventional DNS/IP infrastructure
- Enforce application allow-listing / code-signing verification to block unsigned Electron+NSIS installers, particularly ones downloaded as 'AI tools' from non-vendor sources
- Track the ScarfaceStealer family in threat intel tooling (MalwareBazaar signature ScarfaceStealer, ThreatFox tag ScarfaceStealer) given its continued active sample submissions through 2026-08-10
Timeline of ScarfaceStealer
- Earliest ScarfaceStealer sample submitted to MalwareBazaar, marking the family's first tracked appearance.
- First ScarfaceStealer indicator recorded in ThreatFox's tracking database.
- Most recent ThreatFox sighting recorded prior to Joe Security's Electron/EtherHiding report.
- SonicWall publishes 'An In-Depth Look at Scarface Stealer,' detailing a Go-compiled ScarfaceStealer.Rocket build with heavy space/rocket-themed string and function-name obfuscation.
- eSentire publishes analysis of EtherRAT and the broader EtherHiding technique family (blockchain smart-contract C2 dead-drop resolvers), the same technique class Joe Security later attributes to ScarfaceStealer's C2 retrieval.
- Joe Security publishes 'Inside ScarfaceStealer's Sandbox-Aware Anti-Analysis System,' analyzing the ClaudeMythos.exe Electron/NSIS sample with its 11-indicator scoring system and Ethereum/Polygon smart-contract C2.
- Most recent ScarfaceStealer sample (of 196 tracked total) submitted to MalwareBazaar, indicating an active, ongoing campaign.
Sources cited for ScarfaceStealer
More in malware
- Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon via Anti-Sandbox .NET Chain
- Access-Code-Gated Phishing Chain Delivers Vidar Infostealer via DocuSign Impersonation
- Gigabud Android Banking Trojan Clones Banking Apps via Hidden Work Profile (Vwork/GoldFactory)
- LegionLoader Malware Distributed via Fake Cloudflare CAPTCHA Using the ClickFix Technique
- SloppyRAT: New Remote Access Trojan Deployed via ClickFix in Ransomware-Linked Attacks
Detection coverage for TL-2026-2455
As of 2026-09-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2455 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.